Australia Essential Eight

Why does it matter?

The maturity levels tie each control to the tradecraft it stops, so an organization can pick a target based on how likely it is to be targeted and what an incident would cost.

Key benefits include:

• A prioritized baseline

The eight strategies were designed to complement each other and cover a range of threats; ASD describes them as a minimum set of preventative measures.

• Maturity linked to threat

Maturity Level One addresses commodity tradecraft such as unpatched public exploits and stolen credentials, Level Two a modest step up that includes phishing, and Level Three more adaptive actors.

• Measurable timeframes

At Maturity Level One, critical vulnerabilities in online services are patched within 48 hours, and office productivity suites, web browsers, email clients, PDF software, and security products within two weeks.

• Controlled exceptions

Exceptions are allowed when documented, approved, and reviewed regularly, and appropriate use of exceptions does not stop an organization being assessed as meeting a level.

• Assessment without certification

There is no requirement for independent certification, but assessment may be required by government directive, a regulator, or contract.

How does it work?

Each strategy has requirements at each maturity level, listed in Appendices A to C of the maturity model, with a side-by-side comparison in Appendix D. At Maturity Level One, multi-factor authentication protects an organization's online services, third-party services, and customer services that handle sensitive data, using something users have plus something users know. At Maturity Level Two it extends to privileged and unprivileged users of systems, must be phishing-resistant, and its events are centrally logged.

The November 2023 update added 48-hour patching for vulnerabilities that vendors rate critical or for which working exploits exist, tightened patching of applications exposed to untrusted internet content to two weeks, rebalanced operating system patching for workstations and non-internet-facing devices to one month, and set a minimum multi-factor authentication standard that requires something users have.

In SmartSuite, Cyber & IT Risk tracks cyber risks, vulnerabilities, and security controls, Compliance Management holds the requirements for each maturity level with testing and evidence, and Enterprise Reporting shows progress toward the target level.

Key Elements

• Patch applications and patch operating systems

Asset discovery at least fortnightly, vulnerability scanning daily for internet-facing assets and at least weekly or fortnightly elsewhere, patching within 48 hours when critical or exploited, and removal of software and operating systems that vendors no longer support.

• Multi-factor authentication

Required for users of organization and third-party online services handling sensitive data and for customers of services holding sensitive customer data. Phishing-resistant MFA is required from Maturity Level Two for users and offered to customers.

• Restrict administrative privileges

Privileged access is validated when requested, privileged users get dedicated accounts that cannot browse the internet or read email, and privileged and unprivileged environments are separate. From Level Two, access is disabled after 12 months unless revalidated and after 45 days of inactivity, and administration runs through jump servers.

• Application control

Implemented on workstations at Level One and on internet-facing servers from Level Two, restricting executables, libraries, scripts, installers, and similar files to an approved set. From Level Two, rulesets are validated annually and Microsoft's recommended blocklist is applied.

• Restrict Microsoft Office macros and user application hardening

Macros are disabled for users without a business need, macros from the internet are blocked, and macro antivirus scanning is enabled. Browsers do not process Java or web advertisements from the internet, and Level Two adds blocks such as Win32 API calls from macros.

• Regular backups

Backups of data, applications, and settings follow business criticality, are synchronized to a common point in time, are retained securely, and are restoration-tested in disaster recovery exercises. Unprivileged accounts cannot access others' backups or modify or delete backups.

• Maturity levels and exceptions

Level Zero signals weaknesses. Levels One to Three mitigate increasing tradecraft and targeting. Organizations plan for a target level and move up one level at a time across all eight strategies.

What does it cover?

The Essential Eight is designed to protect organizations' internet-connected IT networks. Its principles can be applied to enterprise mobility and operational technology, but it was not designed for them and other mitigation strategies may fit better. It is aimed at small and medium business, large organizations and critical infrastructure, and government, and it is a minimum set of measures that may need to be supplemented from the Strategies to mitigate cyber security incidents and the Information security manual.

What are its objectives?

The Essential Eight aims to help organizations reduce the likelihood and impact of common cyber incidents through a minimum set of preventative measures.

Mitigate commodity tradecraft at Maturity Level One, such as unpatched public exploits and stolen or guessed credentials.

Defend against phishing-led and more adaptive actors at Maturity Levels Two and Three.

Reach the same maturity level across all eight strategies before moving to the next level.

Keep exceptions to a minimum, and document, approve, and review each one.

Add controls from the Strategies to mitigate cyber security incidents and the Information security manual where the environment warrants.

Framework in Context

ASD publishes a mapping between the Essential Eight maturity model and the Australian Government Information Security Manual (ISM), and the model draws on ASD's Strategies to mitigate cyber security incidents. Organizations commonly also map it to ISO/IEC 27001, the NIST Cybersecurity Framework, and the CIS Critical Security Controls.

Common Framework Mappings

Organizations that assess against the Essential Eight map its controls to the frameworks below to reuse evidence across audits.

Mapped frameworks include:

ASD ISM

CIS Controls v8.1

ISO 27001:2022

ISO 27002:2022

MITRE ATT&CK

NIST CSF 2.0

NIST 800-171 Rev. 3

NIST 800-53 Rev.5

SOC 2